pokiSEC: Privacy for LB-AR Apps

• pokiSEC is a privacy-preserving framework for LB-AR apps that uses geo-indistinguishability and the Planar Staircase Mechanism (PSM) to obfuscate user locations.
• It employs the TR-PSM approach to mitigate both per-location and trajectory-level attacks by reporting new locations only when displacement thresholds are exceeded.
• Empirical evaluations show that pokiSEC enhances quality of service with minimal runtime overhead while offering tunable privacy guarantees for high-frequency AR environments.

pokiSEC is a privacy-preserving client-side framework for location-based augmented reality (LB-AR) applications, particularly exemplified by Pokémon Go–style games. It leverages advanced stochastic mechanisms to protect user location data at both per-fix and trajectory scales while maintaining high quality of service (QoS) and negligible runtime overhead. pokiSEC introduces the Planar Staircase Mechanism (PSM) and Thresholded Reporting with PSM (TR-PSM), enforcing geo-indistinguishability and providing tunable privacy guarantees suitable for high-frequency, interactive AR environments (Seeam et al., 4 Aug 2025).

1. Privacy Threats and Adversarial Model

In LB-AR games, frequent GPS updates are streamed to the server (and implicitly to any eavesdropper), exposing users to two major categories of privacy threats:

• Per-location adversary: Observes each obfuscated location fix $z_t$ and employs Bayesian inference to estimate the true location $x_t$.
• Trajectory-level adversary: Extracts and correlates the sequence $\{z_1,\ldots,z_T\}$ to reconstruct user movement paths, exploiting temporal dependencies for trace inference.

pokiSEC's dual-mechanism architecture is designed to mitigate both per-location and sequential linkage attacks by maximizing posterior uncertainty subject to precise privacy budgets.

2. Formal Privacy Guarantees

pokiSEC adopts formal definitions grounded in geo-indistinguishability:

Geo-Indistinguishability (per-location):

A location mechanism $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$ satisfies $\epsilon$-geo-indistinguishability if for any locations $x$, $x'$, and any measurable set $S$,

$$\Pr[\mathcal{M}(x)\in S] \le e^{\epsilon d(x, x')} \Pr[\mathcal{M}(x')\in S]$$

where $d(\cdot, \cdot)$ is Euclidean distance.

Trace-level Geo-Indistinguishability:

For a session budget $x_t$0, a streaming mechanism $x_t$1 satisfies $x_t$2-GeoInd if, for any traces $x_t$3,

$x_t$4

with $x_t$5.

Sequential composition is used, so the total session budget accumulates with each reported location.

3. Mechanism Design: PSM and TR-PSM

Planar Staircase Mechanism (PSM)

PSM achieves $x_t$6-geo-indistinguishability per-fix by drawing noise from a staircase-shaped probability density, effectively concentrating perturbations closer to zero than traditional Laplacian noise. For $x_t$7,

$x_t$8

$x_t$9 is sampled uniformly on $\{z_1,\ldots,z_T\}$0, yielding the noisy location

$\{z_1,\ldots,z_T\}$1

Expected error approximates $\{z_1,\ldots,z_T\}$2.

Algorithmic Summary:

1. Uniform sample $\{z_1,\ldots,z_T\}$3.
2. Find $\{z_1,\ldots,z_T\}$4 such that cumulative sum $\{z_1,\ldots,z_T\}$5.
3. Compute $\{z_1,\ldots,z_T\}$6 and sample $\{z_1,\ldots,z_T\}$7; output $\{z_1,\ldots,z_T\}$8.

Thresholded Reporting with PSM (TR-PSM)

TR-PSM increases trace-level privacy by reporting a new noisy location only when the displacement from the last released value $\{z_1,\ldots,z_T\}$9 exceeds a private threshold $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$0, where $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$1 is sampled from the PSM. For steps $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$2:

• If $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$3, reuse $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$4.
• If exceeded, release $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$5 and update budget by $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$6.

Session privacy tightens via many-to-one output mappings, raising inference error for adversaries performing trajectory reconstruction.

4. Theoretical Analysis

• PSM satisfies $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$7-GeoInd isometrically (proof by bounding PDF ratios across bins).
• TR-PSM session privacy is $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$8, for $\mathcal{M}: \mathbb{R}^2 \to \mathbb{R}^2$9 threshold crossings.
• QoS analysis: PSM mean error is approximately $\epsilon$0 of Planar Laplace error for small $\epsilon$1.

Bayes risk for trajectory reconstruction under TR-PSM is up to $\epsilon$2 that of baseline, indicating robustness against sequential inference.

5. Empirical Evaluation

Dataset Coverage

• Geolife: 8 m median step, 2 s intervals
• T-Drive: 49 m median step, 181 s intervals
• GeoTrace: Pokémon Go–style trajectories, multimodal, 127 km

Utility and Privacy Benchmarks

Mechanism	Mean Dist. Error (m)	Max Dist. (m)
PLM	19.99	173.34
PSM	10.05	159.46

TR-PSM yields Bayes risk $\epsilon$3–$\epsilon$4 higher than PLM/PSM for $\epsilon$5.

QoS in AR Context

Mechanism	Dense (ε=0.1)	Sparse (ε=0.1)
PLM	28 %	46 %
PSM	42 %	60 %
TR-PSM	38 %	55 %

QoS improvement reaches $\epsilon$6 for object catchability; accumulated loss decreases 30–57% over baseline.

Runtime Overhead

Device	PLM (ms)	PSM (ms)	TR-PSM (ms)
Galaxy A04	0.556	0.559	0.964
Pixel 6a	0.114	0.112	0.152
Galaxy S22	0.054	0.055	0.069

Total client–server pipeline cost is $\epsilon$7 of typical AR location update latency ($\epsilon$8 ms).

6. Client Integration and Tuning

Integration requires:

1. Hook onLocationChanged events to capture $\epsilon$9.
2. Choose $x$0 (tradeoff: 0.1 high privacy, 0.2–0.5 higher QoS), $x$1 (set $x$2 m), and $x$3 (5–10 m threshold).
3. Initialize TR-PSM: sample noisy threshold.
4. Report locations per TR-PSM logic; send only obfuscated $x$4 in server payload.

Recommended session budget: $x$5 with $x$6 for a typical game session.

7. Significance and Applicability

pokiSEC operationalizes geo-indistinguishability for LB-AR at scale with demonstrable QoS gains and minimal latency. Its dual mechanisms allow practitioners to calibrate privacy/QoS for game mechanics and regulatory demands. Its seamless drop-in applicability and rigorous empirical validation mark it as a reference realization of client-side privacy in high-frequency AR environments (Seeam et al., 4 Aug 2025).